Home office cyber security checklist — 7 checks to run now

Run seven practical checks now: secure your router admin and Wi‑Fi, enable MFA on accounts, keep devices patched, use a reliable backup, inventory all endpoints, segregate business traffic, and have an incident step that meets the ICO’s 72‑hour reporting expectation.

Check 1 — Router admin still on factory password

Many breaches start with a router that still uses the box’s default admin login. If you can log into the router with passwords printed on the underside of the unit, treat that as immediate risk. Change the admin username and password, apply the vendor firmware update, and disable remote management unless you use a secure, supported VPN. Practical steps: log into the router web UI, write down new credentials in a password manager, and enable automatic updates or a monthly manual check. Where possible, replace consumer-grade kit older than four years—older devices often stop receiving security patches.

Check 2 — Business accounts lack multi-factor authentication

Password reuse across personal and work accounts is common—attackers test credentials automatically. Enforce multi-factor authentication (MFA) on email, cloud storage (OneDrive/Google Workspace), and any admin consoles. MFA blocks the majority of automated takeover attempts; choose app-based authenticators or hardware tokens rather than SMS where available. Create an onboarding checklist so every employee enables MFA before accessing company data from home, and keep a documented recovery path for locked accounts to avoid service downtime.

Check 3 — Devices haven’t had updates for weeks

Unpatched Windows, macOS, iOS or Android devices are high-value targets. Set device updates to install automatically and confirm that work laptops have full disk encryption enabled (BitLocker/FileVault). For Windows devices, ensure Windows Update and Microsoft Defender are active; for macOS, keep Gatekeeper and SIP current. Use a simple policy: patch within 14 days of release for security updates on business-critical machines. Maintain a short log showing which devices were patched and when; this reduces time spent investigating an exploit.

Check 4 — No central list of home-working devices

Not knowing which devices access company systems makes containment slow. Create a lightweight inventory: device owner, OS and version, last patch date, VPN client status, and whether it’s personal or corporate-managed. Use a spreadsheet or an MDM (mobile device management) tool if you have more than a handful of devices. The inventory should be checked monthly and be the first reference if you suspect compromise. For practical remote-working controls and templates, review Aurora’s remote working checklist.

Check 5 — Backups are missing or untested

Backups that aren’t tested are illusions. Ensure critical business files are backed up off the device to a different location (cloud or on‑premise), and run a restore test quarterly to confirm recoverability. Use the 3‑2‑1 principle where practical: three copies, two different media, one offsite. For small teams, automated cloud backups with versioning are usually the fastest recovery route. Record who last tested a restore and the time it took; that number matters in a ransomware incident.

Check 6 — Home and business traffic on the same network without segregation

Shared networks mean accidental exposure: a smart TV or IoT camera can be a pivot point. Set up a separate guest or VLAN for personal devices, and keep corporate devices on the business SSID with WPA3 or at least WPA2-Enterprise where supported. If VLANs aren’t possible on the router, use a small business access point that supports SSID separation. Segregation cuts lateral movement risk and simplifies firewall rules for remote access tools.

Check 7 — No simple incident playbook for home-working breaches

When something goes wrong, people freeze without a single-sheet response plan. Create a one‑page playbook that lists immediate actions: isolate the device, change critical passwords, preserve logs, who to call internally, and when to report to regulators. The playbook should state the ICO reporting threshold and contact details so whoever’s on duty can act quickly. Keep the playbook to one page and run a tabletop walk-through twice a year; that rehearsal saves hours during a real event. For ICO reporting details, follow official guidance on breach notification (ICO breach reporting).

FAQ

How soon must I report a personal‑data breach to the ICO if it happens from a home device?

If the breach risks people’s rights and freedoms, report to the ICO within 72 hours of discovery; if you can’t meet 72 hours explain the delay and include remediation steps in your report.

How often should I test backups for a home‑based employee?

Test a full restore every three months for critical data and keep a short restore-time log; quarterly checks catch configuration drift and dormant failures before you need them.

Can I rely on Microsoft Defender or should I buy something else?

Microsoft Defender provides baseline protection for Windows devices and is sufficient when combined with MFA and patching; consider extra endpoint controls if you handle highly sensitive data or regulated client work.

What password rules work for a small team working from home?

Require unique, long passphrases (use a password manager) and MFA; avoid forced frequent resets unless there’s evidence of compromise, and maintain an admin password vault for recovery.